Exposing the C&C and loCs (Indicators of Compromise) Infrastructure Behind the 
Democratic National Committee System Intrusion - An OSINT Analysis 
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We've recently decided to take a deeper look inside the Democratic National Committee System 
Intrusion in particular the publicly accessible loCs (Indicators of Compromise) for the purpose of 
enriching them and offering additional insights into the infrastructure of the Russian-based 
attackers using WhoisXML API's vast current and historical database ultimately empowering 
security researchers and organizations with the necessary actionable intelligence to connect the 
dots and make it easier for everyone to keep track of and monitor the cybercriminals behind 
these campaigns. 


In this analysis we'll take an in-depth look inside the Internet-connected infrastructure behind 
the Democratic National Committee System Intrusion and offer additional in-depth insight into 
the Internet-connected infrastructure managed and operated by the cybercriminals behind these 
campaigns. 


Sample malicious and fraudulent domains known to have been involved in the campaign 
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Sample malicious and fraudulent MD5s known to have been involved in the campaign 
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Sample personally identifiable email address accounts known to have been involved in 
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Related malicious and fraudulent domains known to have participated in the campaign 
include: 
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broomstick.net 
coloradocollege.net 
sodapop. info 
tahiticruises.net 
cloudimages.org 
dynamicprogramming.net 
cattoy.org 
walkermowers.net 
boysclothing.info 
barcodescanners. info 
disconnected.info 
distributorship.info 
babby.org 
hearingloss.info 
features. info 
bollywoodmovies.info 
exclusivity.info 
extractors.info 
gaming4u.net 
watermassage.net 
moldtesting.info 
alabamahospitals.org 
greet.info 
fishmarket.info 


mountainwear.net 
fabric-sofa.com 
terracotta-pots.com 
socialseat.com 
diskdefragmenter.net 
colaborate.org 
patienttransport.net 
qnas.net 

aspects. info 
greekcuisine.us 
homewindows. biz 
dogbeach.us 
martinibar.us 
uploadvideos.us 
poweramplifiers.us 
bridemagazine.us 
cybercashcow.net 
charitys.net 
virtualexhibition.net 
sitebydesign.net 
dotmatrixprinters.net 
cilekhost.net 
glassesframe.net 
teknokampus.net 
manhattan-college.com 
stickygloves.com 
autoclassifiedsscript.com 
reperations.com 
athleteposter.com 
gpsemulator.com 
moral-hazard.com 
preventor.net 
mrvid.com 
hollywoodcuties.com 
debt-pros.com 
unlimitedmolds.com 
jewelrymagnifier.com 
dunescooter.com 
avocasprayservice.com 
digitalartcreator.com 
tool-cabinets.com 
radardetector1.com 
servermetro.com 
hairlaserclinics.com 


xScoops.com 
deserthomestoday.com 
localdogbreeders.com 
entertainmentflorida.com 
xraygenerator.com 
universal-designs.com 
cheatguides.com 
electriczoo.com 
terranceadvertising.com 
lukatours.com 
eroticteengirls.com 
modernlodge.com 
teensdigest.com 
streamlinebusinesssolutions.com 
pornicus.com 
hobbydigest.com 
dishcorp.com 
timespansoftware.com 
marinecontrolsys.com 
yogasalon.com 
lahoremall.com 
daniellarush.com 
tripodhgq.com 
softbabestoplist.com 
backtobasicsgym.com 
playersjersey.com 
visiontshirts.com 
highprofilearticles.com 
fuzzypillow.com 
stocktonshop.com 
machinesworld.com 
moviedesk.com 
scoreapps.com 
gndmodelling.com 
action-tours.com 
angel-resume.com 
insanealbums.com 
basicphone.com 
queer411.com 
dog-trekker.com 
alexaweix.com 
pro-board.com 
loveineu.com 
xxxyoga.com 


demolounge.com 
centerfoldmodels.com 
simplyclicktoprofit.com 
royaltonestudios.com 
citecomm.com 
codersource.com 
inforecordsearch.com 
pedcorhomes.com 
testwww.com 
datingdiamond.com 
universitysearches.com 
greenhomemakeover.com 
biodieselcanadainc.com 
vehiclecharging.com 
vaginaldiseases.com 
zombieterror.com 
ptcearning.com 
diydomainer.com 
japancomic.com 
safekidsid.com 
mallportal.com 
marquettajewel.com 
fillwill.com 
absolute-loan.com 
supplementalins.com 
prescriptiondirect.com 
sashaogata.com 
subsonicammo.com 
investmentrentalproperties.com 
plasticbedding.com 
cOrn.com 
promusicvideos.com 
gifcruncher.com 
psychedelicshirts.com 
obituariesarchive.com 
empathising.com 
experato.com 
downloadnewringtones.com 
minicouch.com 
printercleaners.com 
dealershouston.com 
therapy-equipment.com 
ceramic-heaters.com 
3ghotspot.com 


universaltm.com 
barpromoters.com 
bluetooth-device.com 
beveled-mirror.com 
craftcabinet.com 
partyattire.com 
obamabuttons.com 
luxhouses.com 
dogjersey.com 
magiccrystal.com 
overflowstack.com 
istudies.com 
metallicphotopaper.com 
kvsoftware.com 
blingkits.com 
woodenaccents.com 
girls-names.com 
alisdesignmania.com 
runxp.com 
awning-windows.com 
fotay.com 
candle-stands.com 
bjbux.com 
ultrasonicprobe.com 
directglobal.com 
3gdataplan.com 
automotivewires.com 
etcbuzz.com 
eyematching-mobile.com 
articleshelpful.com 
dishtvprovider.com 
foreignexchangesystem.com 
wifiadapters.com 
prxoy.com 
cocktail-glasses.com 
burnrx.com 
motorcyclerestorations.com 
hand-massager.com 
qualityhidkits.com 
louisianarap.com 
astraluxsolar.com 
amusementmachines.com 
nursing-university.com 
girlsmakeup.com 


sewarak.com 
mortgageratescalgary.com 
amber-pendant.com 
platinum-necklace.com 
deviantlatex.com 
boys-names.com 
silk-stocking.com 
pearlbangles.com 
laughlinresorts.com 
metal-siding.com 
creativevectors.com 
kid-laptop.com 
mma-workout.com 
co2keg.com 
okayleads.com 
tranquilscenes.com 
angora-sweaters.com 
musicdiscs.com 
faxatize.com 
sheermensunderwear.com 
denim-vest.com 
womanscollection.com 
powercaps.com 
women-jeans.com 
vanity-chair.com 
hand-rails.com 
cellcharms.com 
nfapp.com 
fleecetights.com 
accessoriescenter.com 
spotprepaid.com 
weedchats.com 
hrtelecommuter.com 
research-grants.com 
baggps.com 
quadcores.com 
grilling-tools.com 
tightcustoms.com 
mobilepetwash.com 
highglosspaints.com 
fixuphome.com 
call-tones.com 
tax-training.com 
iconmuzic.com 


subwoofer-box.com 
towing-equipment.com 
cable-splitter.com 
necklacegold.com 
warriorimport.com 
payment-center.com 
pocket-computer.com 
viewboxplayer.com 
bluetoothprograms.com 
runnerapparel.com 
stoyz.com 
bluetoothprogram.com 
quarry-tile.com 
adultchocolate.com 
bluetoothservices.com 
butter-dish.com 
wetshaver.com 
edaters.com 
painttint.com 
wirelesstvantenna.com 
landlordsinsurance. info 
environmentalism.info 
polishing. info 
eradio.info 

rooftop.info 
internetclassroom.net 
parchment. info 
swappers.info 
hkfish.net 
readertablet.com 
armoredvehicle.net 
mixdepot.net 
organizationalsoftware.com 
phoenixhospitals.org 
huntinggetaways.com 
speedtrainers.com 
unconscious. info 
boathouse. info 
proxyservers.info 
iplookup.info 

fibs.info 

newer.info 
underrated.info 
anesthetic.info 


attorneymesothelioma. info 
federaltaxes.info 
packaged. info 
convictions.info 
palpitations.info 
legality.info 
estateauction.info 
northstar.info 
yammer.info 

joyous. info 
percentage.info 
forbearance. info 
personalization.info 
proceeds. info 
journeyman. info 
thermodynamics. info 
barriers.info 
traded.info 
plunger.info 
festivities.info 
breakable.info 
etching.info 
precalculus.info 
presale.info 
straightener.info 
skank.info 
ecosphere.info 
genealogists.info 
mesotheliomacases. info 
anarchists.info 
sportsarena.info 
freighter.info 
equitable.info 
asbestoscompensation.info 
spox.info 
superstitions.info 
vicious.info 
ganglion.info 
asbestosclaims.info 
asbestosattorneys.info 
painted.info 
ovaries.info 
injurycompensation.info 
arcs.info 


asbestoslitigation.info 
harassed. info 
regrowth.info 
agony.info 
closures. info 
steamers.info 
sadist.info 
sharking.info 
optimizations.info 
reported.info 
contigo.info 
soliciting.info 
inseparable.info 
bday.info 
bureaux.info 
bulletins.info 
spasm.info 
annotation.info 
cobrand.info 
groomsmen. info 
updater.info 
seized.info 
revamp.info 
serenade.info 
liable.info 
solicitation.info 
buyingstocks. info 
rollout.info 
funders. info 
fission.info 
advancement. info 
faxsoftware.info 
addressfinder.info 
enhancing. info 
acceptcreditcards.info 
anecdotes.info 
folktale.info 
downgrade. info 
ambitious.info 
fredrick.info 
dents.info 
acts.info 
encouragement. info 
dominance. info 


micro-computers.com 
helmet-cams.com 
gforce-simracing.com 
body-boards.com 
personalized-checks.com 
anthembook.com 
howtosatisfy.com 
copper-jewelry.com 
macro-lenses.com 
minisnowmobile.com 
key-presser.com 
frog-legs.com 
textwe.com 
cocys.com 
bunnyshoes.com 
odads.com 


Related MD5s known to have participated in the campaign include: 
398ba404e33974792ad569684a8 1 f3ee 
8bb1f6a8436d69f54049eb2d8fa90dca 
dd949759bbb84a1f57f23b95b0d2be14 
e350ff12139840d14317e2ba5267e088 
76b0af2ad32b34824d935f6c27 abaQff 
4d78db79a6ab46ee952c20e17bcad6 1f 
458 1¢c813cbc584530b75c58c30d8b29b 
db651b8d8d051c428bdcf13c503334f2 
ada5265eea4b3a7f5c674d1ae84d6af5 
e4c5f6752f57a1d2d336de57d2d86587 
ecea44e617904fb241f059e08f57bab4 


We'll continue monitoring the campaign and post updates as soon as new developments take 
place. 


